feat: 开放浏览器HTTP站点访问

src/main/browser/session.ts

@@ -12,16 +12,6 @@ import {
   type BrowserSimilarElementOptions
 } from "../engine/types";
 
-const DEFAULT_DOMAINS = ["127.0.0.1", "localhost", "example.com"];
-
-function allowedDomains(): string[] {
-  const extra = (process.env.RPA_ALLOWED_DOMAINS || "")
-    .split(",")
-    .map((item) => item.trim())
-    .filter(Boolean);
-  return [...DEFAULT_DOMAINS, ...extra];
-}
-
 function assertUrl(raw: string): URL {
   let url: URL;
   try {
@@ -32,13 +22,6 @@ function assertUrl(raw: string): URL {
   if (url.protocol !== "http:" && url.protocol !== "https:") {
     throw new RuntimeError("blocked_url", `只允许 http/https，当前为 ${url.protocol}`);
   }
-  const host = url.hostname;
-  const allowed = allowedDomains().some((domain) => host === domain || host.endsWith(`.${domain}`));
-  if (!allowed) {
-    throw new RuntimeError("blocked_url", `域名不在白名单：${host}`, {
-      recommendation: `在设置中把 ${host} 加入白名单（或设置 RPA_ALLOWED_DOMAINS）`
-    });
-  }
   return url;
 }
 

src/renderer/src/pages/SettingsPage.tsx

@@ -29,7 +29,7 @@ export function SettingsPage({ catalog }: { catalog: Catalog }) {
         <button type="button" className={tab === "about" ? "active" : ""} onClick={() => setTab("about")}>关于与运行环境</button>
         <button type="button" className={tab === "catalog" ? "active" : ""} onClick={() => setTab("catalog")}>组件目录</button>
         <button type="button" className={tab === "execution" ? "active" : ""} onClick={() => setTab("execution")}>执行与证据</button>
-        <button type="button" className={tab === "browser" ? "active" : ""} onClick={() => setTab("browser")}>浏览器白名单</button>
+        <button type="button" className={tab === "browser" ? "active" : ""} onClick={() => setTab("browser")}>浏览器访问</button>
       </aside>
 
       <section className="panel setting-body">
@@ -61,8 +61,8 @@ export function SettingsPage({ catalog }: { catalog: Catalog }) {
 
         {tab === "browser" && (
           <>
-            <SettingCard icon={Globe2} title="浏览器域名白名单"><dl className="kv"><dt>默认允许</dt><dd>127.0.0.1、localhost、example.com</dd><dt>本地演示站</dt><dd>{info?.fixtureUrl || "未启动"}</dd><dt>扩展方式</dt><dd>环境变量 RPA_ALLOWED_DOMAINS</dd><dt>格式</dt><dd>逗号分隔域名，不含协议和路径</dd></dl></SettingCard>
+            <SettingCard icon={Globe2} title="浏览器访问范围"><dl className="kv"><dt>默认允许</dt><dd>全部 HTTP/HTTPS 站点</dd><dt>本地演示站</dt><dd>{info?.fixtureUrl || "未启动"}</dd><dt>协议限制</dt><dd>HTTP / HTTPS</dd><dt>用途</dt><dd>支持内网、公网和测试站点</dd></dl></SettingCard>
-            <SettingCard icon={ShieldCheck} title="限制说明"><p className="field-hint setting-copy">导航只允许 HTTP/HTTPS。未列入白名单的域名会返回 blocked_url；文件协议、脚本协议和任意本地路径不会由浏览器导航组件打开。</p></SettingCard>
+            <SettingCard icon={ShieldCheck} title="限制说明"><p className="field-hint setting-copy">浏览器导航不限制域名。只拒绝 HTTP/HTTPS 以外的协议；文件协议、脚本协议和任意本地路径不会由浏览器导航组件打开。</p></SettingCard>
           </>
         )}
       </section>